aol / molochweb Goto Github PK

Hi Everyone,

I'd like to suggest an update to the documentation's Pcap Deletion section. Under "If still having pcap delete issues", add an option 9 saying "Check for unknown* files; The viewer process doesn't delete these files".

Also, it might be nice to mention a disk usage warning in the Save Unknown Packets setting.

As an alternative, perhaps the viewer process could be changed to include the 'unknown' pcap files when deleting.

Thanks for the great tool

-Ian